Skip to main content
Org rulesets defined once, in code, instead of click-ops repeated across every repo.
tofu-github puts the dryvist GitHub organization’s rulesets under OpenTofu, applied through the same Terrakube workspace pattern as the rest of the homelab. GitHub doesn’t auto-inherit CI or branch-protection config across repos — the old pattern was a reusable workflow plus a per-repo call copied into every repo, which drifts. Org rulesets (available since dryvist moved to the GitHub Team plan) let this be defined once and applied to every repo automatically.

​
What it manages

  • Push protection — a hard ceiling on file size and a banned-extension list, enforced at the git layer (no workflow run) on every repo and ref
  • Branch protection — required commit signatures, a branch-name pattern, a strict Conventional Commits regex, and PR thread resolution on every default branch, with no bypass for anyone including org admins
  • Review gate — one approving review plus a CODEOWNER review on every default branch, with an admin-only bypass so admins can merge their own PRs while bots and other contributors still need the review
  • Markdown lint — requires the markdownlint workflow (defined once in the org’s .github repo) to pass on every ref of every repo, with new repos exempted until their default branch exists

​
How it fits

​
Getting started

1

Clone and enter the dev shell

git clone git@github.com:dryvist/tofu-github.git && cd tofu-github && direnv allow
2

Log in to the Terrakube workspace

tofu login "$TF_CLOUD_HOSTNAME" — requires membership in the org’s terrakube-admins team. No AWS account, no local GITHUB_TOKEN: the org-admin GitHub credential is injected by Terrakube at run time.
3

Plan and apply

tofu init && tofu plan && tofu apply — plan and apply execute remotely in Terrakube; output streams back to the local shell.

tofu-proxmox

Same OpenTofu-through-Terrakube pattern, applied to the Proxmox cluster instead of GitHub.

tofu-unifi

Same pattern again, applied to the UniFi controller’s data plane.

CI/CD policy

The per-repo CI/CD conventions these org rulesets enforce the shape of.

Source on GitHub

Ruleset definitions, config thresholds, full README.